Loading threat actor…
CRPxO is a ransomware and extortion threat group that surfaced prominently in mid-2026 and was observed claiming a high volume of victims in a short period, including 41 claims in one reporting week. The group has been associated with attacks against organizations in the United States, Turkey, and South Korea, with a notable concentration of victims in Turkey and the United States. Observed victims span multiple sectors, including financial services, health care, real estate, retail, professional services, transportation, energy, and defense. CRPxO has been linked to ransomware incidents that also involved public claims of stolen data, indicating a data-theft extortion model and likely double-extortion behavior where encryption activity is paired with exfiltration and leak pressure. Reported victim cases include banks, insurers, health-care providers, legal firms, commercial real estate organizations, retailers, aviation entities, and defense-related companies. The group’s victimology suggests broad opportunistic targeting rather than a narrowly specialized sector focus. Known aliases currently supported at high confidence are limited to CRPxO itself. Available information supports ransomware deployment and data exfiltration, but does not provide high-confidence attribution to a nation state, a specific country of origin, or distinct sub-groups. The dominant assessed motivation is financial gain.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as prior-week comparison background and not part of the current week's active ranking.
Ransomware group with the highest number of claimed attacks in the reporting period, leading weekly activity with 41 claims.
Conducting a ransomware attack resulting in a data breach and data leak against Encore Enterprises, Inc.
Conducting a ransomware attack resulting in a data breach against A101, with 0.2 GB of data reportedly leaked.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.